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GAO 


United  States 

General  Accounting  Office 

Washington,  D.C.  20548 


Information  Management  and 
Technology  Division 

B-247094 

February  4, 1992 

The  Honorable  Howard  Wolpe 

Chairman,  Subcommittee  on  Investigations  and  Oversight 
Committee  on  Science,  Space,  and  Technology 
House  of  Representatives 

Dear  Mr.  Chairman: 

On  February  25,  1991,  a  Patriot  missile  defense  system  operating  at 
Dhahran,  Saudi  Arabia,  during  Operation  Desert  Storm  failed  to  track  and 
intercept  an  incoming  Scud.  This  Scud  subsequently  hit  an  Army  barracks, 
killing  28  Americans.  This  report  responds  to  your  request  that  we  review 
the  facts  associated  with  this  incident  and  determine  if  a  computer  soft¬ 
ware  problem  was  involved.  If  so,  you  asked  that  we  provide  information 
on  what  the  specific  software  problem  weis,  and  what  has  been  done  to  cor¬ 
rect  it.  Appendix  I  details  our  objectives,  scope,  and  methodology. 


Results  in  Brief 


The  Patriot  battery  at  Dhahran  failed  to  track  and  intercept  the  Scud  mis¬ 
sile  because  of  a  software  problem  in  the  system’s  weapons  control  com¬ 
puter.  This  problem  led  to  an  inaccurate  tracking  calculation  that  became 
worse  the  longer  the  system  operated.  At  the  time  of  the  incident,  the  bat¬ 
tery  had  been  operating  continuously  for  over  100  hours.  By  then,  the  inac¬ 
curacy  was  serious  enough  to  cause  the  system  to  look  in  the  wrong  place 
for  the  incoming  Scud. 

The  Patriot  had  never  before  been  used  to  defend  against  Scud  missiles  nor 
was  it  expected  to  operate  continuously  for  long  periods  of  time.  Two 
weeks  before  the  incident.  Army  officials  received  Israeli  data  indicating 
some  loss  in  accuracy  after  the  system  had  been  running  for  8  consecutive 
hours.  Consequently,  Army  officials  modified  the  software  to  improve  the 
system’s  accuracy.  However,  the  modified  software  did  not  reach  Dhahran 
until  February  26,  1991— the  day  after  the  Scud  incident. 


Background 


The  Patriot  is  an  Army  surface-to-air,  mobile,  air  defense  missile  system. 
Since  the  mid-1960s,  the  system  has  evolved  to  defend  against  aircraft  and 
cruise  missiles,  and  more  recently  against  short-range  ballistic  missiles. 
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Figure  1:  Patriot  Fired  for  Missile 
Interception 


Source:  Department  of  Defense 


The  Patriot  system  was  originally  designed  to  operate  in  Europe  against 
Soviet  medium-  to  high-altitude  aircraft  and  cruise  missiles  traveling  at 
speeds  up  to  about  MACH  2  (1500  mph).  To  avoid  detection  it  was 
designed  to  be  mobile  and  operate  for  only  a  few  hours  at  one  location. 
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The  Patriot  operates  as  part  of  a  battalion  usually  composed  of  six  bat¬ 
teries.  Each  battery  is  made  up  of  one  ground-based  radar  unit  for  smveil- 
lance  and  target  detection,  tracking,  and  engagement;  an  Engagement 
Control  Station  for  manual  or  automated  command  and  control  of  the  mis¬ 
sile  interceptors;  eight  missile  launchers;  and  a  Communications  Relay 
Group  for  communications  support.  An  Information  Coordination  Center 
controls  the  batteries  and  coordinates  their  operation  with  other  battalions 
and  higher  level  U.S.  Command  authorities. 


Figure  2:  Patriot  Missiie  Launcher  in  Saudi  Arabia 
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The  heart  of  the  Patriot  system  is  its  weapons  control  computer.  It  per¬ 
forms  the  system’s  major  functions  for  tracking  and  intercepting  a  target, 
as  well  as  other  battle  management,  command  and  control  functions.  The 
Patriot’s  weapons  control  computer  used  in  Operation  Desert  Storm  is 
based  on  a  1970s  design  with  relatively  Umited  capability  to  perform  high 
precision  calculations. 

To  carry  out  its  mission,  the  Patriot’s  weapons  control  computer  obtains 
target  information  from  the  system’s  radar.  The  Patriot’s  radar  sends  out 
electronic  pulses  that  scan  the  air  space  above  it.  When  the  pulses  hit  a 
target  they  are  reflected  back  to  the  radar  system  and  shown  as  an  object 
(or  plot)  on  the  Patriot’s  display  screens.*  Patriot  operators  use  the  soft¬ 
ware  to  instruct  the  system  to  intercept  certain  types  of  objects  such  as 
planes,  cruise  missiles,  or  tactical  baUistic  missiles  (such  as  Scuds).  During 
Desert  Storm  the  Patriot  was  instructed  to  intercept  tactical  ballistic  mis¬ 
siles.  For  the  Patriot’s  computer  to  identify,  track,  and  intercept  these 
missiles,  important  information^  describing  them  was  kept  by  the  system’s 
range-gate  algorithm.'* 

After  the  Patriot’s  radar  detects  an  airborne  object  that  has  the  characteris¬ 
tics  of  a  Scud,  the  range  gate— an  electronic  detection  device  within  the 
radar  system— calculates  an  area  in  the  air  space  where  the  system  should 
next  look  for  it.  The  range  gate  filters  out  information  about  airborne 
objects  outside  its  calculated  area  and  only  processes  the  information 
needed  for  tracking,  targeting,  and  intercepting  Scuds.  Finding  an  object 
within  the  calculated  range  gate  area  confirms  that  it  is  a  Scud  missile. 
Figure  3  depicts  a  correctly  calculated  range  gate  area. 


radar  plot  indicates  the  object’s  position  in  terms  of  latitude,  longitude,  and  azimuth  (elevation  angle 
in  degrees  from  the  radar).  A  radar  track  is  a  series  of  plots  that,  when  processed,  indicate  an  object’s 
altitude,  speed,  direction,  and  position. 

^Such  information  includes  velocity  (speed  and  direction),  latitude,  longitude,  azimuth,  and  altitude. 
^An  algorithm  is  a  precise  description  of  a  method  for  solving  a  particular  problem. 


Page  4 


GAO/IMTEC-92-26  Patriot  Missile  Software  Problem 


B-247094 


Figure  3:  Correctly  Calculated  Range  Gate 


3.  Track  Action  -  Only  Range  Gated 
Portion  of  Beam  Processed 


2.  Validation 
Actbn 
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1.  Search  Action- 
No  Range  Gate- 
Entire  Beam 
Processed 
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Patriot  Radar 
System 


The  range  gate’s  prediction  of  where  the  Scud  will  next  appear  is  a  function 
of  the  Scud’s  known  velocity  and  the  time  of  the  last  radar  detection. 
Velocity  is  a  real  number  that  can  be  expressed  as  a  whole  number  and  a 
decimal  (e.g.,  3760.2563. ..miles  per  hour).  Time  is  kept  continuously  by 
the  system’s  internal  clock  in  tenths  of  seconds  but  is  expressed  as  an 
integer  or  whole  number  (e.g.,  32,  33,  34...).  The  longer  the  system  has 
been  nmning,  the  larger  the  number  representing  time.  To  predict  where 
the  Scud  will  next  appear,  both  time  and  velocity  must  be  expressed  as  real 
numbers.  Because  of  the  way  the  Patriot  computer  performs  its  calcula¬ 
tions  and  the  fact  that  its  registers^  are  only  24  bits  long,  the  conversion  of 
time  from  an  integer  to  a  real  number  cannot  be  any  more  precise  than  24 


^Registers  are  temporary  storage  areas  for  instructions  or  data.  They  are  special  .storage  locations 
whose  advantage  is  speed.  They  can  very  rapidly  accept  and  transfer  instructions  or  data  and  are  there¬ 
fore  used  in  perfonning  arithmetic  or  comparison  operations. 
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bits.®  This  conversion  results  in  a  loss  of  precision  causing  a  less  accurate 
time  calculation.  The  effect  of  this  inaccuracy  on  the  range  gate’s 
calculation  is  directly  proportional  to  the  target’s  velocity  and  the  length  of 
time  the  system  has  been  running.  Consequently,  performing  the  conver¬ 
sion  after  the  Patriot  has  been  running  continuously  for  extended  periods 
causes  the  range  gate  to  shift  away  from  the  center  of  the  target,  making  it 
less  likely  that  the  target,  in  this  case  a  Scud,  will  be  successfully  inter¬ 
cepted. 


Key  Events  Leading  to 
Patriot’s  Failure  to 
Intercept  Scud  Missile 


Shortly  after  Operation  Desert  Shield  began.  Patriot  battalions  were 
deployed  to  Saudi  Arabia  and  then  to  Israel.  These  battalions  were  gener¬ 
ally  placed  in  permanent  positions  to  defend  key  assets,  military  personnel, 
and  citizens  against  Iraqi  Scud  missiles. 

Because  this  was  the  first  time  the  Patriot  had  been  used  to  defend  against 
Scud  missiles,  which  fly  at  approximately  MACH  5  (3750  mph),  the  Army 
had  much  to  learn  about  tracking  and  intercepting  them.  To  obtain  Scud 
data,  the  Army  relied  on  operational  experience  conveyed  by  Patriot  users 
as  well  as  other  intelligence  sources.  With  the  launch  of  each  Scud,  the 
Army  became  more  and  more  knowledgeable  about  the  Scud’s  flight 
characteristics.  Recorded  data  is  another  more  useful  tool  that  could  have 
provided  detailed  data  on  the  Patriot’s  actual  performance.  However, 
obtaining  recorded  performance  data  from  Patriot  units  was  hindered  for 
two  reasons. 


First,  the  Patriot  was  not  equipped  with  an  embedded  (internal)  data 
recorder  to  retain  system  performance  information.  Second,  although  por¬ 
table,  external  data  recorders  were  available,  U.S.  commanders  decided 
not  to  use  them  because  they  believed  the  recorders  could  cause  an  unan¬ 
ticipated  system  shutdown.  However,  Israeli  commanders  used  data 
recorders  on  the  Patriot  systems  they  controlled  and  provided  this  data  to 
the  U.S.  Army.  As  information  from  all  sources  became  available,  software 
changes  were  made  from  August  1990  to  February  1991  by  the  Patriot 
Project  Office  in  Huntsville,  Alabama,  to  adapt  the  system  to  the  Desert 
Storm  environment.  During  the  conflict  the  Patriot’s  software  was  modified 
six  times.  Patriots  had  to  be  shut  down  for  at  least  1  to  2  hours  to  install 
each  software  modification. 


®The  precision  of  a  computer’s  calculations  depends  on  the  number  of  bits  in  its  registers.  Since  the 
Patriot’s  registers  are  only  24  bits  long,  precision  beyond  24  bits  is  not  possible  unless  the  software  is 
specifically  written  to  ac^ust  for  such  hardware  limitations.  Computers  built  today  have  registers  that 
contain  as  many  as  64  bits,  permitting  calculations  with  far  greater  precision. 


Page  6 


GAO/IMTEC-92-26  Patriot  Missile  Software  Problem 


B-247094 


Anomaly  Observed  in  Patriot  On  February  1 1 , 1 99 1 ,  the  Patriot  Project  Office  received  Israeli  data  iden- 
Range  Gate  tifying  a  20  percent  shift  in  the  Patriot  system’s  radar  range  gate  after  the 

system  had  been  running  for  8  consecutive  hours.  (Figure  4  depicts  the 
location  of  a  Scud  within  the  range  gate  after  the  Patriot  has  been  in  opera¬ 
tion  for  over  8  hours.)  This  shift  is  significant  because  it  meant  that  the 
target  (in  this  case,  the  Scud)  was  no  longer  in  the  center  of  the  range  gate. 
The  target  needs  to  be  in  the  center  of  the  range  gate  to  ensure  the  highest 
probability  of  tracking  the  target.  As  previously  mentioned,  the  range  gate 
is  calculated  by  an  algorithm  that  determines  if  the  detected  target  is  a 
Scud,  and  if  the  Scud  is  in  the  Patriot’s  firing  range.  If  these  conditions  are 
met,  the  Patriot  fires  its  missiles. 


Figure  4:  Calculated  Range  Gate  After  Approximately  8  Hours 
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Patriot  Project  Office  officials  said  that  the  Patriot  system  will  not  track  a 
Scud  when  there  is  a  range  gate  shift  of  50  percent  or  more.  Because  the 
shift  is  directly  proportional  to  time,  extrapolating  the  Israeli  data  (which 
indicated  a  20  percent  shift  after  8  hours)  determined  that  the  range  gate 
would  shift  50  percent  after  about  20  hours  of  continuous  use.  Specifically, 
after  about  20  hours,  the  inaccurate  time  ceilculation  becomes  sufficiently 
large  to  cause  the  radar  to  look  in  the  wrong  place  for  the  target. 
Consequently,  the  system  fails  to  track  and  intercept  the  Scud.  See  Figure 
5  for  a  representation  of  an  incorrect  range  gate  calculation.  Appendix  II 
shows  the  number  of  meters  the  range  gate  shifts  from  the  center  of  the 
target  after  continuous  operation. 


Figure  5:  Incorrectly  Calculated  Range  Gate 
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Significant  shifts  of  the  range  gate  away  from  the  desired  center  of  the 
target  could  be  eliminated  by  rebooting  the  system— turning  the  system  off 
and  on— every  few  hours.  Rebooting,  which  takes  about  60  to  90  seconds, 
reinitializes  the  computer’s  clock,  setting  the  time  back  to  zero. 


Patriot  Project  Office  Army  officials  said  that  they  believed  the  Israeli  experience  was 

Response  to  Anomaly  atypical-they  assumed  other  Patriot  users  were  not  rimning  their  systems 

for  8  or  more  hours  at  a  time.  However,  after  analyzing  the  Israeli  data  and 
confirming  some  loss  in  targeting  accuracy,  the  officials  made  a  software 
change  which  compensated  for  the  inaccurate  time  calculation.  This 
change  allowed  for  extended  nm  times  and  was  included  in  the  modified 
software  version  that  was  released  on  February  16, 1991.  However,  Army 
officials  did  not  use  the  IsraeU  data  to  determine  how  long  the  Patriot  could 
operate  before  the  inaccurate  time  calculation  would  render  the  system 
ineffective. 

On  February  21, 1991,  the  Patriot  Project  Office  sent  a  message  to  Patriot 
users  stating  that  very  long  run  times  could  cause  a  shift  in  the  range  gate, 
resulting  in  the  target  being  offset.  The  message  also  said  a  software 
change  was  being  sent  that  would  improve  the  system’s  targeting.  How¬ 
ever,  the  message  did  not  specify  what  constitutes  very  long  run  times. 
According  to  Army  officials,  they  presvuned  that  the  users  would  not 
continuously  run  the  batteries  for  such  extended  periods  of  time  that  the 
Patriot  would  faU  to  track  targets.  Therefore,  they  did  not  think  that  more 
detailed  guidance  was  required. 


Iraqi  Scud  Attack  and  The  air  fields  and  seaports  of  Dhahran  were  protected  by  six  Patriot  bat- 

Aftermath  teries.  Alpha  Battery,  the  battery  in  question,  weis  to  protect  the  Dhahran 

Air  Base.  On  February  25,  Alpha  Battery  had  been  in  operation  for  over 
100  consecutive  hours.  Because  the  system  had  been  on  so  long,  the 
resulting  inaccuracy  in  the  time  calculation  caused  the  range  gate  to  shift 
so  much  that  the  system  could  not  track  the  incoming  Scud.  Consequently, 
Alpha  Battery  did  not  engage  the  Scud,  which  then  struck  an  Army  bar¬ 
racks  and  killed  28  American  soldiers. 

On  February  26,  the  next  day,  the  modified  software,  which  compensated 
for  the  inaccurate  time  calculation,  arrived  in  Dhahran.  According  to  Army 
officials,  the  delay  in  distributing  the  software  from  the  United  States  to  all 
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Patriot  locations  was  due  to  the  time  it  took  to  arrange  for  air  and  ground 
transportation  in  a  wartime  environment. 

In  September  1991,  officials  from  the  Patriot  Project  Office  stated  that 
Patriot  algorithms  will  continue  to  be  re-examined  8is  a  result  of  experience 
gained  during  Desert  Storm  and  will  continue  to  be  tested  against  aircraft, 
cruise,  and  tactical  ballistic  missiles.  Further,  an  endurance  test  has  been 
conducted  to  ensure  that  extended  run  times  do  not  cause  other  system 
difficulties. 


We  conducted  our  review  from  June  1991  to  January  1992,  in  accordance 
with  generally  accepted  government  auditing  standards.  As  requested,  we 
did  not  provide  a  draft  of  this  report  to  the  Department  of  Defense  for  its 
review  and  comment.  Instead,  we  discussed  the  report’s  facts  with  officials 
involved  and  incorporated  their  views  as  appropriate.  These  officials  gener¬ 
ally  agreed  with  the  facts  as  presented.  We  plan  no  further  distribution  of 
this  report  until  30  days  from  the  date  of  this  letter.  We  will  then  send 
copies  to  the  Secretary  of  Defense,  the  Secretary  of  the  Army,  and  other 
interested  parties.  Copies  will  also  be  made  available  to  others  upon 
request.  Should  you  have  any  questions  concerning  this  report,  please  con¬ 
tact  Samuel  Bowlin,  Director,  Defense  and  Security  Information  Systems  at 
(202)  336-6240.  Major  contributors  to  this  report  are  listed  in  appendix 


Sincerely  yours. 


Assistant  Comptroller  General 
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Objectives,  Scope,  and  Methodology 


The  Chairman,  Subcommittee  on  Investigations  and  Oversight,  House 
Committee  on  Science,  Space,  and  Technology,  requested  that  we  review 
the  facts  of  the  February  25, 1991,  incident  in  which  the  Patriot  defense 
system  failed  to  engage  an  Iraqi  Scud  missile  and  determine  if  a  computer 
software  problem  was  involved.  If  so,  our  objectives  were  to  provide  infor¬ 
mation  on  what  specific  software  problem  prevented  the  Patriot  from 
intercepting  the  Scud  missile  and  what  has  been  done  to  correct  it. 

To  meet  these  objectives,  we  interviewed  Patriot  Project  Office  officials 
responsible  for  maintaining  Patriot  software  and  reviewed  official  Depart¬ 
ment  of  the  Army  analyses  describing  the  cause  of  this  incident. 
Subsequently,  we  independently  verified  the  Army’s  findings  by  analyzing 
key  documentation  including  (1)  a  description  of  the  Patriot  system  com¬ 
puter  architecture;  (2)  the  assembly  language  programs  responsible  for 
surveillance,  tracking,  and  target  engagement;  and  (3)  selected  machine 
instructions  that  caused  the  tracking  inaccuracy. 

To  determine  what  was  done  to  locate  and  correct  the  software  problem, 
we  interviewed  software  maintenance  officials  at  the  Patriot  Project  Office 
and  obtained  documentation  on  the  specific  changes  made  to  the  software. 
Additionally,  we  checked  the  Army’s  correction  to  the  software  by  per¬ 
forming  the  key  calculations  needed  to  account  for  longer  run  times. 

To  become  more  knowledgeable  about  how  the  Patriot  system  performed 
in  an  operational  environment,  we  participated  in  a  simulation  at  the 
Patriot  Software  Test  Facility  in  Huntsville,  Alabama,  where  we  intercepted 
Scuds  with  Patriot  missiles.  Through  the  simulation,  we  gained  a  better 
understanding  of  the  Patriot’s  hardware,  software,  and  human  interfaces. 
Further,  we  interviewed  and  obtained  documentation  from  officials 
involved  in  Patriot  software  and  operations  at  the  Department  of  the  Army 
Headquarters  in  Washington,  D.C. 

Our  work  was  conducted  from  June  1991  through  January  1992  at  the 
Department  of  the  Army,  Washington  D.C.,  and  the  Patriot  Program  Office, 
Huntsville,  Alabama. 
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Appendix  II 


Effect  of  Extended  Run  Time  on  Patriot 
Operation 


Calculated  Time 

Inaccuracy 

Approximate  Shift  in 

Hours 

Seconds 

(Seconds) 

(Seconds) 

Range  Gate  (Meters) 

0 

0 

0 

0 

0 

1 

3600 

3599.9966 

.0034 

7 

8 

28800 

28799.9725 

.0275 

55 

20^ 

72000 

71999.9313 

.0687 

137 

48 

172800 

172799.8352 

.1648 

330 

72 

259200 

259199.7528 

.2472 

494 

o 

o 

cr 

360000 

359999.6667 

.3433 

687 

^Continuous  operation  exceeding  about  20  hours— target  outside  range  gate 
‘^Alpha  Battery  ran  continuously  for  about  100  hours 
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Appendix  III 


Mggor  Contributors  to  This  Report 


Information 
Management  and 
Technology  Division, 
Washington,  D.C. 


Michael  Blair,  Assistant  Director 
Sally  Obenski,  Evaluator-in-Charge 
Paula  Bridickas,  Computer  Scientist 


(610680) 


Page  16 


GAO/IMTEC-92-26  Patriot  Missile  Software  Problem 


